Cloud Network Micro Segmentation GCAD Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security architect is planning a micro-segmentation rollout for a legacy application that has undocumented dependencies. The application is business-critical and cannot tolerate downtime. Which approach balances the need for security improvement with the risk of disruption?

   • AUse a network tap to capture traffic for a day and then enforce policies based on that snapshot.
   • BAsk the application team to document all dependencies and then enforce policies immediately.
   • CDeploy a distributed firewall in monitoring mode, analyze traffic for several weeks, then create policies based on the observed flows and enforce them incrementally.
   • DImmediately enforce a default-deny policy and then add exceptions as the application breaks.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team is implementing micro-segmentation in a large environment. They have identified application dependencies and created a set of policies. Before enforcing the policies, what should they do to minimize disruption?

   • ARun the policies in a simulation or monitoring-only mode to verify they do not block legitimate traffic.
   • BSkip testing and rely on the policy design documentation.
   • COnly enforce policies on non-critical workloads first, but do not monitor the results.
   • DDeploy the policies to all workloads at once to ensure consistency.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security team has implemented micro-segmentation using a distributed firewall. During a routine audit, they discover that some workloads have been communicating with each other in violation of the stated policies. The firewall logs show that the traffic was allowed. What is the most likely cause?

   • AThe security team forgot to enable logging on the firewall.
   • BThe workloads were added to the firewall after the policies were created, and the policies were not applied to them.
   • CThe firewall logs are incorrect due to a software bug.
   • DThe workloads are using a protocol that the firewall cannot inspect.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   After deploying micro-segmentation policies, the security team needs to ensure that the policies remain effective as workloads change. Which practice is most important for ongoing management?

   • ASet policies once and only update them during scheduled quarterly maintenance windows.
   • BRely on the cloud provider's default security groups to automatically adjust to workload changes.
   • CRegularly review firewall logs and policy changes, and use automated tools to detect policy drift.
   • DUse a single, broad policy that allows all traffic between workloads to avoid breaking applications.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which advantage does a distributed firewall provide over a traditional centralized firewall?

   • AIt reduces the number of security policies needed
   • BIt eliminates the need for network segmentation entirely
   • CIt allows security policies to follow workloads as they move across the cloud
   • DIt provides a single point of failure for all traffic
   Reveal Solution Discussion Select an answer first